diff --git a/library/bignum.c b/library/bignum.c
index 36effaf8da..b62f3f2c37 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -54,6 +54,142 @@
#define MPI_VALIDATE(cond) \
MBEDTLS_INTERNAL_VALIDATE(cond)
+/*
+ * Compare signed values in constant time
+ */
+int mbedtls_mpi_lt_mpi_ct(const mbedtls_mpi *X,
+ const mbedtls_mpi *Y,
+ unsigned *ret)
+{
+ size_t i;
+ /* The value of any of these variables is either 0 or 1 at all times. */
+ unsigned cond, done, X_is_negative, Y_is_negative;
+
+ MPI_VALIDATE_RET(X != NULL);
+ MPI_VALIDATE_RET(Y != NULL);
+ MPI_VALIDATE_RET(ret != NULL);
+
+ if (X->n != Y->n) {
+ return MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
+ }
+
+ /*
+ * Set sign_N to 1 if N >= 0, 0 if N < 0.
+ * We know that N->s == 1 if N >= 0 and N->s == -1 if N < 0.
+ */
+ X_is_negative = (X->s & 2) >> 1;
+ Y_is_negative = (Y->s & 2) >> 1;
+
+ /*
+ * If the signs are different, then the positive operand is the bigger.
+ * That is if X is negative (X_is_negative == 1), then X < Y is true and it
+ * is false if X is positive (X_is_negative == 0).
+ */
+ cond = (X_is_negative ^ Y_is_negative);
+ *ret = cond & X_is_negative;
+
+ /*
+ * This is a constant-time function. We might have the result, but we still
+ * need to go through the loop. Record if we have the result already.
+ */
+ done = cond;
+
+ for (i = X->n; i > 0; i--) {
+ /*
+ * If Y->p[i - 1] < X->p[i - 1] then X < Y is true if and only if both
+ * X and Y are negative.
+ *
+ * Again even if we can make a decision, we just mark the result and
+ * the fact that we are done and continue looping.
+ */
+ cond = mbedtls_ct_mpi_uint_lt(Y->p[i - 1], X->p[i - 1]);
+ *ret |= cond & (1 - done) & X_is_negative;
+ done |= cond;
+
+ /*
+ * If X->p[i - 1] < Y->p[i - 1] then X < Y is true if and only if both
+ * X and Y are positive.
+ *
+ * Again even if we can make a decision, we just mark the result and
+ * the fact that we are done and continue looping.
+ */
+ cond = mbedtls_ct_mpi_uint_lt(X->p[i - 1], Y->p[i - 1]);
+ *ret |= cond & (1 - done) & (1 - X_is_negative);
+ done |= cond;
+ }
+
+ return 0;
+}
+
+/*
+ * Conditionally assign X = Y, without leaking information
+ * about whether the assignment was made or not.
+ * (Leaking information about the respective sizes of X and Y is ok however.)
+ */
+#if defined(_MSC_VER) && defined(_M_ARM64) && (_MSC_FULL_VER < 193131103)
+/*
+ * MSVC miscompiles this function if it's inlined prior to Visual Studio 2022 version 17.1. See:
+ * https://developercommunity.visualstudio.com/t/c-compiler-miscompiles-part-of-mbedtls-library-on/1646989
+ */
+__declspec(noinline)
+#endif
+int mbedtls_mpi_safe_cond_assign(mbedtls_mpi *X,
+ const mbedtls_mpi *Y,
+ unsigned char assign)
+{
+ int ret = 0;
+ MPI_VALIDATE_RET(X != NULL);
+ MPI_VALIDATE_RET(Y != NULL);
+
+ /* all-bits 1 if assign is 1, all-bits 0 if assign is 0 */
+ mbedtls_mpi_uint limb_mask = mbedtls_ct_mpi_uint_mask(assign);
+
+ MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, Y->n));
+
+ X->s = (int) mbedtls_ct_uint_if(assign, Y->s, X->s);
+
+ mbedtls_mpi_core_cond_assign(X->p, Y->p, Y->n, assign);
+
+ for (size_t i = Y->n; i < X->n; i++) {
+ X->p[i] &= ~limb_mask;
+ }
+
+cleanup:
+ return ret;
+}
+
+/*
+ * Conditionally swap X and Y, without leaking information
+ * about whether the swap was made or not.
+ * Here it is not ok to simply swap the pointers, which would lead to
+ * different memory access patterns when X and Y are used afterwards.
+ */
+int mbedtls_mpi_safe_cond_swap(mbedtls_mpi *X,
+ mbedtls_mpi *Y,
+ unsigned char swap)
+{
+ int ret = 0;
+ int s;
+ MPI_VALIDATE_RET(X != NULL);
+ MPI_VALIDATE_RET(Y != NULL);
+
+ if (X == Y) {
+ return 0;
+ }
+
+ MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, Y->n));
+ MBEDTLS_MPI_CHK(mbedtls_mpi_grow(Y, X->n));
+
+ s = X->s;
+ X->s = (int) mbedtls_ct_uint_if(swap, Y->s, X->s);
+ Y->s = (int) mbedtls_ct_uint_if(swap, s, Y->s);
+
+ mbedtls_mpi_core_cond_swap(X->p, Y->p, X->n, swap);
+
+cleanup:
+ return ret;
+}
+
/* Implementation that should never be optimized out by the compiler */
static void mbedtls_mpi_zeroize(mbedtls_mpi_uint *v, size_t n)
{
diff --git a/library/bignum_core.c b/library/bignum_core.c
index de57cfc04c..a51b3f404e 100644
--- a/library/bignum_core.c
+++ b/library/bignum_core.c
@@ -168,6 +168,46 @@ unsigned mbedtls_mpi_core_uint_le_mpi(mbedtls_mpi_uint min,
return min_le_lsl | msll_nonzero;
}
+unsigned mbedtls_mpi_core_lt_ct(const mbedtls_mpi_uint *A,
+ const mbedtls_mpi_uint *B,
+ size_t limbs)
+{
+ unsigned ret, cond, done;
+
+ /* The value of any of these variables is either 0 or 1 for the rest of
+ * their scope. */
+ ret = cond = done = 0;
+
+ for (size_t i = limbs; i > 0; i--) {
+ /*
+ * If B[i - 1] < A[i - 1] then A < B is false and the result must
+ * remain 0.
+ *
+ * Again even if we can make a decision, we just mark the result and
+ * the fact that we are done and continue looping.
+ */
+ cond = mbedtls_ct_mpi_uint_lt(B[i - 1], A[i - 1]);
+ done |= cond;
+
+ /*
+ * If A[i - 1] < B[i - 1] then A < B is true.
+ *
+ * Again even if we can make a decision, we just mark the result and
+ * the fact that we are done and continue looping.
+ */
+ cond = mbedtls_ct_mpi_uint_lt(A[i - 1], B[i - 1]);
+ ret |= cond & (1 - done);
+ done |= cond;
+ }
+
+ /*
+ * If all the limbs were equal, then the numbers are equal, A < B is false
+ * and leaving the result 0 is correct.
+ */
+
+ return ret;
+}
+
void mbedtls_mpi_core_cond_assign(mbedtls_mpi_uint *X,
const mbedtls_mpi_uint *A,
size_t limbs,
diff --git a/library/bignum_core.h b/library/bignum_core.h
index 21a5a11c6a..1fc5375755 100644
--- a/library/bignum_core.h
+++ b/library/bignum_core.h
@@ -148,6 +148,24 @@ unsigned mbedtls_mpi_core_uint_le_mpi(mbedtls_mpi_uint min,
const mbedtls_mpi_uint *A,
size_t A_limbs);
+/**
+ * \brief Check if one unsigned MPI is less than another in constant
+ * time.
+ *
+ * \param A The left-hand MPI. This must point to an array of limbs
+ * with the same allocated length as \p B.
+ * \param B The right-hand MPI. This must point to an array of limbs
+ * with the same allocated length as \p A.
+ * \param limbs The number of limbs in \p A and \p B.
+ * This must not be 0.
+ *
+ * \return The result of the comparison:
+ * \c 1 if \p A is less than \p B.
+ * \c 0 if \p A is greater than or equal to \p B.
+ */
+unsigned mbedtls_mpi_core_lt_ct(const mbedtls_mpi_uint *A,
+ const mbedtls_mpi_uint *B,
+ size_t limbs);
/**
* \brief Perform a safe conditional copy of an MPI which doesn't reveal
* whether assignment was done or not.
diff --git a/library/constant_time.c b/library/constant_time.c
index 16d7a1fc41..135a6ece3f 100644
--- a/library/constant_time.c
+++ b/library/constant_time.c
@@ -405,188 +405,3 @@ void mbedtls_ct_memcpy_offset(unsigned char *dest,
#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
-#if defined(MBEDTLS_BIGNUM_C)
-
-#define MPI_VALIDATE_RET(cond) \
- MBEDTLS_INTERNAL_VALIDATE_RET(cond, MBEDTLS_ERR_MPI_BAD_INPUT_DATA)
-
-/*
- * Conditionally assign X = Y, without leaking information
- * about whether the assignment was made or not.
- * (Leaking information about the respective sizes of X and Y is ok however.)
- */
-#if defined(_MSC_VER) && defined(_M_ARM64) && (_MSC_FULL_VER < 193131103)
-/*
- * MSVC miscompiles this function if it's inlined prior to Visual Studio 2022 version 17.1. See:
- * https://developercommunity.visualstudio.com/t/c-compiler-miscompiles-part-of-mbedtls-library-on/1646989
- */
-__declspec(noinline)
-#endif
-int mbedtls_mpi_safe_cond_assign(mbedtls_mpi *X,
- const mbedtls_mpi *Y,
- unsigned char assign)
-{
- int ret = 0;
- MPI_VALIDATE_RET(X != NULL);
- MPI_VALIDATE_RET(Y != NULL);
-
- /* all-bits 1 if assign is 1, all-bits 0 if assign is 0 */
- mbedtls_mpi_uint limb_mask = mbedtls_ct_mpi_uint_mask(assign);
-
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, Y->n));
-
- X->s = (int) mbedtls_ct_uint_if(assign, Y->s, X->s);
-
- mbedtls_mpi_core_cond_assign(X->p, Y->p, Y->n, assign);
-
- for (size_t i = Y->n; i < X->n; i++) {
- X->p[i] &= ~limb_mask;
- }
-
-cleanup:
- return ret;
-}
-
-/*
- * Conditionally swap X and Y, without leaking information
- * about whether the swap was made or not.
- * Here it is not ok to simply swap the pointers, which would lead to
- * different memory access patterns when X and Y are used afterwards.
- */
-int mbedtls_mpi_safe_cond_swap(mbedtls_mpi *X,
- mbedtls_mpi *Y,
- unsigned char swap)
-{
- int ret = 0;
- int s;
- MPI_VALIDATE_RET(X != NULL);
- MPI_VALIDATE_RET(Y != NULL);
-
- if (X == Y) {
- return 0;
- }
-
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, Y->n));
- MBEDTLS_MPI_CHK(mbedtls_mpi_grow(Y, X->n));
-
- s = X->s;
- X->s = (int) mbedtls_ct_uint_if(swap, Y->s, X->s);
- Y->s = (int) mbedtls_ct_uint_if(swap, s, Y->s);
-
- mbedtls_mpi_core_cond_swap(X->p, Y->p, X->n, swap);
-
-cleanup:
- return ret;
-}
-
-/*
- * Compare unsigned values in constant time
- */
-unsigned mbedtls_mpi_core_lt_ct(const mbedtls_mpi_uint *A,
- const mbedtls_mpi_uint *B,
- size_t limbs)
-{
- unsigned ret, cond, done;
-
- /* The value of any of these variables is either 0 or 1 for the rest of
- * their scope. */
- ret = cond = done = 0;
-
- for (size_t i = limbs; i > 0; i--) {
- /*
- * If B[i - 1] < A[i - 1] then A < B is false and the result must
- * remain 0.
- *
- * Again even if we can make a decision, we just mark the result and
- * the fact that we are done and continue looping.
- */
- cond = mbedtls_ct_mpi_uint_lt(B[i - 1], A[i - 1]);
- done |= cond;
-
- /*
- * If A[i - 1] < B[i - 1] then A < B is true.
- *
- * Again even if we can make a decision, we just mark the result and
- * the fact that we are done and continue looping.
- */
- cond = mbedtls_ct_mpi_uint_lt(A[i - 1], B[i - 1]);
- ret |= cond & (1 - done);
- done |= cond;
- }
-
- /*
- * If all the limbs were equal, then the numbers are equal, A < B is false
- * and leaving the result 0 is correct.
- */
-
- return ret;
-}
-
-/*
- * Compare signed values in constant time
- */
-int mbedtls_mpi_lt_mpi_ct(const mbedtls_mpi *X,
- const mbedtls_mpi *Y,
- unsigned *ret)
-{
- size_t i;
- /* The value of any of these variables is either 0 or 1 at all times. */
- unsigned cond, done, X_is_negative, Y_is_negative;
-
- MPI_VALIDATE_RET(X != NULL);
- MPI_VALIDATE_RET(Y != NULL);
- MPI_VALIDATE_RET(ret != NULL);
-
- if (X->n != Y->n) {
- return MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
- }
-
- /*
- * Set sign_N to 1 if N >= 0, 0 if N < 0.
- * We know that N->s == 1 if N >= 0 and N->s == -1 if N < 0.
- */
- X_is_negative = (X->s & 2) >> 1;
- Y_is_negative = (Y->s & 2) >> 1;
-
- /*
- * If the signs are different, then the positive operand is the bigger.
- * That is if X is negative (X_is_negative == 1), then X < Y is true and it
- * is false if X is positive (X_is_negative == 0).
- */
- cond = (X_is_negative ^ Y_is_negative);
- *ret = cond & X_is_negative;
-
- /*
- * This is a constant-time function. We might have the result, but we still
- * need to go through the loop. Record if we have the result already.
- */
- done = cond;
-
- for (i = X->n; i > 0; i--) {
- /*
- * If Y->p[i - 1] < X->p[i - 1] then X < Y is true if and only if both
- * X and Y are negative.
- *
- * Again even if we can make a decision, we just mark the result and
- * the fact that we are done and continue looping.
- */
- cond = mbedtls_ct_mpi_uint_lt(Y->p[i - 1], X->p[i - 1]);
- *ret |= cond & (1 - done) & X_is_negative;
- done |= cond;
-
- /*
- * If X->p[i - 1] < Y->p[i - 1] then X < Y is true if and only if both
- * X and Y are positive.
- *
- * Again even if we can make a decision, we just mark the result and
- * the fact that we are done and continue looping.
- */
- cond = mbedtls_ct_mpi_uint_lt(X->p[i - 1], Y->p[i - 1]);
- *ret |= cond & (1 - done) & (1 - X_is_negative);
- done |= cond;
- }
-
- return 0;
-}
-
-#endif /* MBEDTLS_BIGNUM_C */
diff --git a/library/constant_time_internal.h b/library/constant_time_internal.h
index bfeb8c55ec..e085478d69 100644
--- a/library/constant_time_internal.h
+++ b/library/constant_time_internal.h
@@ -129,24 +129,6 @@ unsigned mbedtls_ct_size_bool_eq(size_t x,
unsigned mbedtls_ct_mpi_uint_lt(const mbedtls_mpi_uint x,
const mbedtls_mpi_uint y);
-/**
- * \brief Check if one unsigned MPI is less than another in constant
- * time.
- *
- * \param A The left-hand MPI. This must point to an array of limbs
- * with the same allocated length as \p B.
- * \param B The right-hand MPI. This must point to an array of limbs
- * with the same allocated length as \p A.
- * \param limbs The number of limbs in \p A and \p B.
- * This must not be 0.
- *
- * \return The result of the comparison:
- * \c 1 if \p A is less than \p B.
- * \c 0 if \p A is greater than or equal to \p B.
- */
-unsigned mbedtls_mpi_core_lt_ct(const mbedtls_mpi_uint *A,
- const mbedtls_mpi_uint *B,
- size_t limbs);
#endif /* MBEDTLS_BIGNUM_C */
/** Choose between two integer values without branches.